Agent skill

Token 2022 Extensions

Trigger Pattern TOKEN2022 flag detected (token2022/spltoken2022/transferchecked usage) - Inject Into Breadth agents, depth agents

MITAuto-check passedBusiness, Finance & HR

Install Token 2022 Extensions

skills CLI

$ npx skills add PlamenTSV/plamen --skill token-2022-extensions -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen token-2022-extensions --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .claude/skills && cp -r skills-src/agents/skills/solana/token-2022-extensions .claude/skills/token-2022-extensions && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "token-2022-extensions" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/token-2022-extensions into .claude/skills/token-2022-extensions/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "token-2022-extensions", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/token-2022-extensions

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add PlamenTSV/plamen --skill token-2022-extensions -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen token-2022-extensions --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .agents/skills && cp -r skills-src/agents/skills/solana/token-2022-extensions .agents/skills/token-2022-extensions && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "token-2022-extensions" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/token-2022-extensions into .agents/skills/token-2022-extensions/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "token-2022-extensions", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add PlamenTSV/plamen --skill token-2022-extensions -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen token-2022-extensions --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/agents/skills/solana/token-2022-extensions .cursor/skills/token-2022-extensions && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "token-2022-extensions" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/token-2022-extensions into .cursor/skills/token-2022-extensions/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "token-2022-extensions", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/PlamenTSV/plamen.git --path agents/skills/solana/token-2022-extensions

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add PlamenTSV/plamen --skill token-2022-extensions -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen token-2022-extensions --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/agents/skills/solana/token-2022-extensions .gemini/skills/token-2022-extensions && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "token-2022-extensions" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/token-2022-extensions into .gemini/skills/token-2022-extensions/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "token-2022-extensions", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install PlamenTSV/plamen token-2022-extensions

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add PlamenTSV/plamen --skill token-2022-extensions -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .github/skills && cp -r skills-src/agents/skills/solana/token-2022-extensions .github/skills/token-2022-extensions && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "token-2022-extensions" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/token-2022-extensions into .github/skills/token-2022-extensions/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "token-2022-extensions", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add PlamenTSV/plamen --skill token-2022-extensions -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen token-2022-extensions --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/agents/skills/solana/token-2022-extensions .opencode/skills/token-2022-extensions && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "token-2022-extensions" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/token-2022-extensions into .opencode/skills/token-2022-extensions/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "token-2022-extensions", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: token-2022-extensions
GitHub stars: 303
Token cost: ~1.5k tokens
SKILL.md length: 555 words
Files: 1
Skills in repo: 87
Repo updated: Sep 26, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Trigger Pattern TOKEN2022 flag detected (token2022/spltoken2022/transferchecked usage) - Inject Into Breadth agents, depth agents

Works in 8 steps: Extension Inventory → Extension Allowlist → Permanent Delegate Risk → …
Pattern TOKEN2022 flag detected (token2022/spltoken2022/transferchecked usage) - Inject Into Breadth agents
SKILL.md covers 1. Extension Inventory, 2. Extension Allowlist, 3. Permanent Delegate Risk and 4. Transfer Hook Analysis, plus 6 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Token 2022 Extensions is an agent skill from PlamenTSV/plamen. Trigger Pattern TOKEN2022 flag detected (token2022/spltoken2022/transferchecked usage) - Inject Into Breadth agents, depth agents

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Business, Finance & HR. It works with Solana. The repository describes itself as: Autonomous Web3 security audit agent for Claude Code. The licence is MIT.

When your agent uses it

Pattern TOKEN2022 flag detected (token2022/spltoken2022/transferchecked usage) - Inject Into Breadth agents

Example prompts

“/token-2022-extensions”

Workflow steps

8 steps, taken from the step headings in SKILL.md.

Extension Inventory
Extension Allowlist
Permanent Delegate Risk
Transfer Hook Analysis
Transfer Fee Accounting
CPI Guard Handling
Default Account State
Mint Existence Verification (MintCloseAuthority)

What it can do on your machine

Read from SKILL.md and the folder at commit 795962b. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Token 2022 Extensions loads about 1.5k tokens when it runs. Until then it costs about 39 tokens; SKILL.md has 555 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~39
When it runs · the whole SKILL.md, loaded when a task matches: ~1.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from PlamenTSV/plamen at commit 795962b, republished under its MIT licence (© PlamenTSV). 555 words, ~1,457 tokens.

Download SKILL.mdSave it as .claude/skills/token-2022-extensions/SKILL.md (or your agent's skills folder).

name: token-2022-extensions
description: Trigger Pattern TOKEN_2022 flag detected (token_2022/spl_token_2022/transfer_checked usage) - Inject Into Breadth agents, depth agents

TOKEN_2022_EXTENSIONS Skill

Trigger Pattern: TOKEN_2022 flag detected (token_2022/spl_token_2022/transfer_checked usage) Inject Into: Breadth agents, depth agents Finding prefix: [T22-N] Rules referenced: S9, R3, R11

For every token mint the program interacts with that may use Token-2022:

1. Extension Inventory

For each mint:

Mint	Token Program	Extensions Detected	Extension Impact
{mint}	token / token-2022	{list: TransferFee, TransferHook, PermanentDelegate, MintCloseAuthority, DefaultAccountState, etc.}	{brief per-extension impact}

Detection: Check if program uses spl_token_2022 or token_2022 imports. Check mint account data length (Token-2022 mints are larger due to extension data).

2. Extension Allowlist

Does the program explicitly check which extensions are supported?

Check	Present?	Location	Missing Extensions Handled?
Extension allowlist / blocklist	YES/NO	{line}	{what happens with unsupported extension}

Attack (S9): Program designed for basic SPL Token interacts with Token-2022 mint that has unexpected extensions (e.g., PermanentDelegate). Program doesn't check → extension silently affects behavior. Defense: Explicitly check mint extensions and reject unsupported ones.

3. Permanent Delegate Risk

For each mint with PermanentDelegate extension:

Mint	Permanent Delegate	Trust Level	Vault Drain Scenario	Mitigation
{mint}	{delegate pubkey}	{trusted/untrusted/unknown}	{can delegate drain vault?}	{what prevents it}

Attack: Permanent delegate can transfer tokens FROM any token account of that mint, without the account owner's approval. If protocol holds tokens of a PermanentDelegate mint → delegate can drain them at any time.

4. Transfer Hook Analysis

For each mint with TransferHook extension:

Mint	Hook Program	Hook Verified?	CU Budget Impact	Recursion Risk?
{mint}	{program_id}	YES/NO	{estimated CU}	YES/NO

Risks:

Hook program can consume significant CU, causing transactions to fail
Hook program can revert, blocking all transfers of this token
Hook program may have its own CPI chain, adding depth
Hook may read additional accounts not provided by the caller

5. Transfer Fee Accounting

For each mint with TransferFeeConfig:

Mint	Fee Rate	Fee Accounted in Protocol Math?	Amount Received < Amount Sent?
{mint}	{bps}	YES/NO	{if NO: accounting mismatch}

Attack: Protocol calculates expected amounts without deducting transfer fee → accounting mismatch, potential insolvency. Pattern: transfer_checked returns the gross amount. The net amount received is gross - fee. Protocol must use net amount in accounting.

Show full SKILL.md (219 more words)Show less

6. CPI Guard Handling

For transfers through delegation (CPI transfers):

Transfer Type	Uses CPI?	CPI Guard Enabled on Mint?	Transfer Works?
{type}	YES/NO	YES/NO/Unknown	{if CPI Guard + delegation: may fail}

CPI Guard: When enabled, prevents token account delegates from transferring via CPI. Programs that rely on delegated transfers via CPI will fail silently.

7. Default Account State

For mints with DefaultAccountState extension:

Mint	Default State	Protocol Handles Frozen?	Impact
{mint}	Frozen / Initialized	YES/NO	{if frozen: new token accounts start frozen, need thaw}

8. Mint Existence Verification (MintCloseAuthority)

For mints with MintCloseAuthority extension:

Mint	Close Authority	Checked Before Read?	Impact if Mint Closed
{mint}	{authority}	YES/NO	{if NO: reading zeroed data, incorrect decimals/supply}

Attack: Mint with MintCloseAuthority can be closed (if supply == 0). Protocol reads closed mint → gets zeroed data → decimals = 0, incorrect calculations.

Finding Template

markdown

**ID**: [T22-N]
**Severity**: [PermanentDelegate drain = Critical, transfer fee mismatch = High, CPI Guard = Medium]
**Step Execution**: ✓1,2,3,4,5,6,7,8 | ✗(reasons) | ?(uncertain)
**Rules Applied**: [S9:✓, R3:✓, R11:✓/✗]
**Location**: program/src/{file}.rs:LineN
**Title**: Token-2022 [extension] in [context] enables [attack]
**Description**: [Specific extension vulnerability with data flow]
**Impact**: [Fund drain / accounting mismatch / DoS]

Step Execution Checklist (MANDATORY)

Section	Required	Completed?	Notes
1. Extension Inventory	YES	✓/✗/?	For every mint
2. Extension Allowlist	YES	✓/✗/?	Explicit check present?
3. Permanent Delegate Risk	IF PermanentDelegate	✓/✗(N/A)/?	Vault drain scenario
4. Transfer Hook Analysis	IF TransferHook	✓/✗(N/A)/?	CU + revert risk
5. Transfer Fee Accounting	IF TransferFee	✓/✗(N/A)/?	Net vs gross
6. CPI Guard Handling	IF delegated CPI transfers	✓/✗(N/A)/?	Delegation + CPI Guard
7. Default Account State	IF DefaultAccountState	✓/✗(N/A)/?	Frozen by default
8. Mint Existence Verification	IF MintCloseAuthority	✓/✗(N/A)/?	Closed mint reads

Files

Just SKILL.md in agents/skills/solana/token-2022-extensions of PlamenTSV/plamen.

Open the folder on GitHubat commit 795962b

Compare with similar skills

Token 2022 Extensions next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Token 2022 Extensions compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Token 2022 Extensions this skillPlamenTSV/plamen	303	—	~1.5k	Automated safety check: Pass	MIT	12 days ago
Swapper Depositswapperfinance/swapper-toolkit	852	—	~1.8k	Automated safety check: Pass	MIT	6 mo ago
Drift SDKalsk1992/CloddsBot	2.9k	1 repos	~625	Automated safety check: Pass	MIT	6 days ago
Prismirfndi/prism-liquidity-agent	122	—	~1.5k	Automated safety check: Pass	MIT	10 days ago
Ansem Cryptoquestflowai/investorskills	1.9k	—	~793	Automated safety check: Pass	MIT	1 mo ago
Solana Skillnpc-live/clawfirm	156	—	~1k	Automated safety check: Pass	None	3 mo ago

Similar skills

Swapper Deposit
swapperfinance/swapper-toolkit
Deposit and bridge funds into a wallet or protocol using Swapper Finance.
852 GitHub stars~1.8k tokensUpdated 6 mo ago
Business, Finance & HRAuto-check passed
Drift SDK
alsk1992/CloddsBot
Drift Protocol perpetual futures trading on Solana (direct SDK)
2.9k GitHub starsUsed in 1 repo~625 tokens
Business, Finance & HRAuto-check passed
Prism
irfndi/prism-liquidity-agent
Operate Prism, an autonomous Solana DLMM liquidity agent for Meteora pools.
122 GitHub stars~1.5k tokensUpdated 10 days ago
Business, Finance & HRAuto-check passed
Ansem Crypto
questflowai/investorskills
A skill your agent uses when evaluating crypto narratives, attention rotation, memecoin cycles, Solana-style ecosystem momentum, social distribution, and reflexive retail flows in an Ansem-style…
1.9k GitHub stars~793 tokensUpdated 1 mo ago
Business, Finance & HRAuto-check passed
Solana Skill
npc-live/clawfirm
Interact with Solana blockchain via Helius APIs. An agent skill from npc-live/clawfirm.
156 GitHub stars~1k tokensUpdated 3 mo ago
Business, Finance & HRAuto-check passed
Birdeye API
agiprolabs/claude-trading-skills
Solana token market data via Birdeye — prices, OHLCV, trades, token metadata, security checks, and trader activity
410 GitHub stars~1.8k tokensUpdated 1 mo ago
Business, Finance & HRAuto-check passed

Questions about Token 2022 Extensions

What does Token 2022 Extensions do?

Trigger Pattern TOKEN2022 flag detected (token2022/spltoken2022/transferchecked usage) - Inject Into Breadth agents, depth agents. Token 2022 Extensions is an agent skill from PlamenTSV/plamen.

When should I use Token 2022 Extensions?

Token 2022 Extensions fits situations like: pattern TOKEN2022 flag detected (token2022/spltoken2022/transferchecked usage) - Inject Into Breadth agents.

How do I install Token 2022 Extensions in Claude Code?

Run `npx skills add PlamenTSV/plamen --skill token-2022-extensions -a claude-code`. Or copy the skill folder (agents/skills/solana/token-2022-extensions in PlamenTSV/plamen) into .claude/skills/token-2022-extensions in your project. Claude Code loads it when a task matches its description.

How do I install Token 2022 Extensions in Codex?

Run `npx skills add PlamenTSV/plamen --skill token-2022-extensions -a codex`. Or copy the skill folder (agents/skills/solana/token-2022-extensions in PlamenTSV/plamen) into .agents/skills/token-2022-extensions in your project. Codex loads it when a task matches its description.

Can I use Token 2022 Extensions in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add PlamenTSV/plamen --skill token-2022-extensions -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/token-2022-extensions, .gemini/skills/token-2022-extensions, .github/skills/token-2022-extensions and .opencode/skills/token-2022-extensions in your project.

What does Token 2022 Extensions need to run?

SKILL.md names no scripts, command-line tools or credentials: Token 2022 Extensions is instructions for the agent only.

Does Token 2022 Extensions access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Token 2022 Extensions safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Token 2022 Extensions use?

Token 2022 Extensions is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Token 2022 Extensions use?

About 1.5k tokens (SKILL.md is roughly 5.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Token 2022 Extensions?

Skills that share tags, products or a category with Token 2022 Extensions: Swapper Deposit (swapperfinance/swapper-toolkit, 852 stars), Drift SDK (alsk1992/CloddsBot, 2.9k stars), Prism (irfndi/prism-liquidity-agent, 122 stars) and Ansem Crypto (questflowai/investorskills, 1.9k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Token 2022 Extensions?

PlamenTSV (a GitHub user) maintains it in PlamenTSV/plamen, which has 303 GitHub stars. The repository holds 87 skills in this directory. The repository was last updated on September 26, 2026.

Source: PlamenTSV/plamen on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Token 2022 Extensions

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

TOKEN_2022_EXTENSIONS Skill

1. Extension Inventory

2. Extension Allowlist

3. Permanent Delegate Risk

4. Transfer Hook Analysis

5. Transfer Fee Accounting

6. CPI Guard Handling

7. Default Account State

8. Mint Existence Verification (MintCloseAuthority)

Finding Template

Step Execution Checklist (MANDATORY)

Files

Compare with similar skills

Similar skills

More from PlamenTSV/plamen

Related

Questions about Token 2022 Extensions